XSS in Teradici Cloud Access Connector
CVE-2020-13176
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.008 (56.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Teradici Cloud Access Connector
- Teradici Cloud Access Connector Legacy
- - Cloud Access Connector Legacy — versions Cloud Access Connector Legacy prior to April 24, 2020, Cloud Access Connector, v16 and earlier)
Weakness classification (CWE)
References
- advisory.teradici.com/security-advisories/59/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-13176?
- CVE-2020-13176 is a medium-severity vulnerability in Teradici Cloud Access Connector, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-08-11.
- How severe is CVE-2020-13176?
- Medium severity. CVSS v3 base score is 6.1 out of 10.